CWE-908 vulnerabilities

Use of uninitialized resource in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to disclose information over a network.

Use of uninitialized resource in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to disclose information over a network.

Use of uninitialized resource in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to disclose information over a network.

Use of uninitialized resource in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to disclose information over a network.

Use of uninitialized resource in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to disclose information over a network.

Untrusted pointer dereference in Microsoft Graphics Component allows an unauthorized attacker to execute code over a network.

Use of uninitialized resource in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to disclose information over a network.

Use of uninitialized resource in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

In high traffic environments, a Silicon Labs OpenThread RCP (see impacted versions) fails to clear the SPI transmit buffer and may send a corrupt packet over SPI to its host,  causing the host to reset the RCP which results in a denial of service.

VMware ESXi, Workstation, Fusion, and VMware Tools contains an information disclosure vulnerability due to the usage of an uninitialised memory in vSockets. A malicious actor with local administrative privileges on a virtual machine may be able to exploit this issue to leak memory from processes communicating with vSockets.

Use of uninitialized resource in SQL Server allows an unauthorized attacker to disclose information over a network.

Use of uninitialized resource in Windows Netlogon allows an unauthorized attacker to elevate privileges over a network.

Use of uninitialized resource in Windows DWM Core Library allows an authorized attacker to disclose information locally.

CVE-2025-21959 is a vulnerability in the Linux kernel's netfilter nf_conncount component where the struct nf_conncount_tuple was not fully initialized in the insert_tree() function. This uninitialized memory usage was identified by Kernel Memory Sanitizer (KMSAN) and could lead to undefined behavior. The issue was introduced due to incomplete initialization of new fields 'cpu' and 'jiffies32' after refactoring. The vulnerability affects Linux kernel version 4.14.92.

Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments. This advisory contains the container images for Red Hat OpenShift Container Platform 4.14.48. See the following advisory for the RPM packages for this release: https://access.redhat.com/errata/RHSA-2025:1453 Space precludes documenting all of the container images in this advisory. See the following Release Notes documentation, which will be updated shortly for this release, for details about these changes: https://docs.openshift.com/container-platform/4.14/release_notes/ocp-4-14-release-notes.html Security Fix(es): * rsync: Info Leak via Uninitialized Stack Contents (CVE-2024-12085) * golang.org/x/crypto/ssh: Misuse of ServerConfig.PublicKeyCallback may cause authorization bypass in golang.org/x/crypto (CVE-2024-45337) * golang.org/x/net/html: Non-linear parsing of case-insensitive content in golang.org/x/net/html (CVE-2024-45338) * kernel: media: uvcvideo: Skip parsing frames of type UVC_VS_UNDEFINED in uvc_parse_format (CVE-2024-53104) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. All OpenShift Container Platform 4.14 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.openshift.com/container-platform/4.14/updating/updating_a_cluster/updating-cluster-cli.html

Windows Smart Card Reader Information Disclosure Vulnerability

Microsoft Message Queuing Information Disclosure Vulnerability

Microsoft Outlook Remote Code Execution Vulnerability

Windows COM Server Information Disclosure Vulnerability